summaryrefslogtreecommitdiff
path: root/source4
Commit message (Collapse)AuthorAgeFilesLines
* winbind: Generate and pass logon IDGary Lockyer2019-02-201-1/+1
| | | | | | | Generate a random logon_id and pass it in the SamLogon calls. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* kdc hdb: Generate and pass logon IDGary Lockyer2019-02-201-2/+4
| | | | | | | Generate and pass the logon_id in SamLogon calls Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4 rpc netlogon: Pass logon_id to auth loggingGary Lockyer2019-02-201-0/+9
| | | | | | | | Pass the logon_id passed in the netlogon identity information to auth_logging. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* librpc idl: netlogon netr_identity_info logon_id to 64 bitGary Lockyer2019-02-2010-26/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fold the two 32 bit values logon_id_high and logon_id_low into a single 64 bit logon_id in netr_identity_info. This will be used to tie together winbind and SamLogon requests in audit logging. Summary of the of the Query and Response from Microsoft on it's usage. [REG:119013019612095] [MS-NRPC]: NETLOGON_LOGON_IDENTITY_INFO: Does the Reserved field have LogonId meaning? Questions: In NetrLogonSamLogonEx does the Reserved field (of NETLOGON_LOGON_IDENTITY_INFO) have LogonId meaning? What is a valid LogonID, and does have any audit usage? Samba is sending a constant "deadbeef" in hex and would like to understand any usage of this field. Response: The NRPC spec is accurate in defining the field as Reserved, and without protocol significance. In the header file in our source code, it is defined as LogonId and commented as such, but it’s effectively not used. This is probably why the API structure has that field name. It may have been intended as such but it’s not used. Samba will send a random value in this field. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3 winbind auth_log: Tests for logon id logging.Gary Lockyer2019-02-201-0/+4
| | | | | | | | | | | Tests to validate that winbind generates a random logon_id and passes it in the netlogon call. This will allow the linking of the windbind authentication requests and the SamLogon request on the DC. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* selftest: Remove need for $RODC_DC_SERVER env variableTim Beale2019-02-181-1/+1
| | | | | | | | Same deal as earlier patch - we can use the $SERVER env variable instead and avoid the need for this extra variable. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* selftest: Remove unused environment variablesTim Beale2019-02-181-12/+0
| | | | | | | | | | | | | | | | | | We only really want generic environment variables. For 2+ DC environments, we have the $SERVER and $DC_SERVER (aka PDC) variables. However, lots of testenvs also export really specific environment variables, e.g. VAMPIRE_2000_DC_SERVER_IP (despite that testenv being only used for a single test case). Previously the <testenv>_SERVER variable was used for DRS tests, but we can avoid the need to do this now. The other variables are not used at all. The RODC and TRUST environment variables are still used by a few tests. SUBDOM_DC_SERVER is only used within Samba4.pm and not exported. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tests: Tweak DRS tests to avoid unnecessary env variablesTim Beale2019-02-181-13/+15
| | | | | | | | | | | | Each DC used in a DRS test has its own '<testenv>_SERVER' environment variable, e.g. VAMPIRE_DC_SERVER. These variables are only used by test.py for DRS, but they're not actually needed. The $SERVER environment variable holds the same information, so we can just use this in test.py instead. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* sambaundoguididx: use the right escaped oder unescaped sam ldb filesBjörn Jacke2019-02-171-2/+1
| | | | | | | | | | | the correct filename is taken from the partition database before, we should not unescape that because this can result in a new unescaped ldb file being created and the script not to work at all. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13759 Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4 dsdb util: samdb_client_site_name clean upGary Lockyer2019-02-141-16/+14
| | | | | | | | | | | | * Initialise pointers to NULL * replace talloc_free with TALLOC_FREE * add goto exit to ensure memory deallocated correctly Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Feb 14 06:53:14 CET 2019 on sn-devel-144
* s4 dsdb util: remove samdb_search_countGary Lockyer2019-02-141-20/+0
| | | | | | | | All the uses have been replaced with calls to dsdb_domain_count, so it is no longer needed. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4 dsdb util: samdb_client_site_name use dsdb_domain_countGary Lockyer2019-02-141-3/+14
| | | | | | | | | Replace the call to samdb_search_count with dsdb_domain_count. As this is the only remaining caller of samdb_search_count, replacing it will allow the removal of samdb_search_count. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4 rpc_server_samr: DomGeneralInformation use dsdb_domain_countGary Lockyer2019-02-141-13/+58
| | | | | | | | | | Use dsdb_domain_count instead of samdb_search_count to determine the number of users, groups and aliases. This gives a performance gain of around 10%, reduces the total memory allocated and fixes the incorrect count returned for aliases. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4 dsdb util: add dsdb_domain_countGary Lockyer2019-02-141-0/+178
| | | | | | | | | | | | This counts the number of objects that are in the domain, provided a domain SID was supplied (otherwise it just counts all the objects). This routine avoids allocating memory for the full result set by using a callback. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba_dnsupdate: make rodc_dns_update() more robust against timing problemsStefan Metzmacher2019-02-141-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this we had an interesting race! The messaging_dgm code caches connected datagram sockets based on the destination pid for 1 second. The fact that samba_dnsupdate constantly recreates its messaging context (and the underlying datagram socket) means that we the winbindd messaging context may get a stale connection. As a result sending any message from winbindd back to samba_dnsupdate will result in ECONNREFUSED. That means the IRPC response from winbindd never reaches samba_dnsupdate, which will then hit a timeout. In turn samba_dnsupdate on the RODC times out. This was a workaround for the problem, by having just one global IRPC handle and thus just one messaging_dgm context. The actual problem is solved a few commits before ("messages_dgm: Properly handle receiver re-initialization"). But we keep this as an performance optimization, which hopefully means that the overall samba_dnsupdate is less likely to timeout after the hardcoded 20 seconds. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* samba_dnsupdate: make it clear that opts.use_file is active and we're not ↵Stefan Metzmacher2019-02-141-3/+6
| | | | | | | using nsupdate Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:setup: register ${NTDSGUID}._msdcs.${DNSFOREST} first in dns_update_listStefan Metzmacher2019-02-141-1/+1
| | | | | | | | After the A and AAAA records for the ${HOSTNAME} this is the most important name. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Make sure results from GetAttrString are decref'ed where neededNoel Power2019-02-132-7/+28
| | | | | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett abartlet@samba.org Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Wed Feb 13 14:51:12 CET 2019 on sn-devel-144
* Fix instances of PyDict_SetItem to decref the valueNoel Power2019-02-131-105/+241
| | | | | | | | | Although it would be better to use the BuildValue approach to create the dictionares here, unfortunately the dictionaries created here have key/values that are created dynamically (based on input params). Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett abartlet@samba.org
* Fix mem leak with PyBytes_FromStringAndSizeNoel Power2019-02-131-3/+6
| | | | Reviewed-by: Andrew Bartlett abartlet@samba.org
* replmd: move a if (ret) closer to ret sourceDouglas Bagnall2019-02-131-4/+5
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: check NULL guid strings in la_fix_linksDouglas Bagnall2019-02-131-3/+11
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: linked attrs: check a talloc_new()Douglas Bagnall2019-02-131-1/+6
| | | | | | | Also we can defer it past a thing that doesn't need or check for it. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: make get_parsed_dns_trusted() a common helper functionDouglas Bagnall2019-02-134-58/+57
| | | | | | | | | | | We are already using it in two places, and are about to add a third. The version in repl_meta_data.c did more work in the case that the parsed_dns can't really be trusted to conform to the expected format; this is now a wrapper called get_parsed_dns_trusted_fallback(). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* spelling of associatedDouglas Bagnall2019-02-131-3/+3
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb/tests/vlv: use only one toplevel dn that is correctly cleaned upStefan Metzmacher2019-02-111-9/+9
| | | | | | | | | Before "OU=vlvtestou2,%s" % (self.base_dn) was left behind after the test. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb:util: export SAMBA_CPS_{ACCOUNT,USER_PRINCIPAL,FULL}_NAME for check ↵Stefan Metzmacher2019-02-113-0/+50
| | | | | | | | | | password script This allows the check password script to reject the username and other things. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dnsserver: Return access denied to the caller if the user was not a DNS adminGarming Sam2019-02-111-7/+25
| | | | | | | | | | | | | | | This is not a proper fix to match Windows, but at the very least, it should be more obvious to users (using samba-tool for instance), that the user needs to be given more access or that they should use the administrator. Windows seems to deny access altogether by returning a fault after they have bound to the pipe and actually sent an operation. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13771 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4: torture: vfs_fruit. Change test_fruit_locking_conflict() to match the ↵Jeremy Allison2019-02-081-5/+21
| | | | | | | | | | | | | | | | | | | | | vfs_fruit working server code. Originally added for BUG: https://bugzilla.samba.org/show_bug.cgi?id=13584 to demonstrate a lock order violation, this test exposed problems in the mapping of SMB1/2 share modes and open modes to NetATalk modes once we moved to OFD locks. Change the test slightly (and add comments) so it demonstrates working NetATalk share modes on an open file. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13770 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Feb 8 23:26:46 CET 2019 on sn-devel-144
* s4/registry/py: use unsigned ParseTuple format for unsigned valueDouglas Bagnall2019-02-081-1/+1
| | | | | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Fri Feb 8 17:09:51 CET 2019 on sn-devel-144
* s4/messaging/py: use better format strings for variable typesDouglas Bagnall2019-02-081-4/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
* s4/librpc/py_misc: ParseTuple format should match actual typesDouglas Bagnall2019-02-081-1/+1
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
* torture4: Solaris cc can't deal with empty initializersVolker Lendecke2019-02-081-7/+7
| | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Mulder <dmulder@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4/scripting/bin: open unicode files with utf8 encoding and write unicode stringJoe Guo2019-02-082-8/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In files like `libcli/util/werror_err_table.txt` and `libcli/util/ntstatus_err_table.txt`, there were unicode quote symbols at line 6: ...(“this documentation”)... In `libcli/util/wscript_build`, it will run `gen_werror.py` and `gen_ntstatus.py` to `open` above files, read content from them and write to other files. When encoding not specified, `open` in both python 2/3 will guess encoding from locale. When locale is not set, it defaults to POSIX or C, and then python will use encoding `ANSI_X3.4-1968`. So, on a system locale is not set, `make` will fail with encoding error for both python 2 and 3: File "/home/ubuntu/samba/source4/scripting/bin/gen_werror.py", line 139, in main errors = parseErrorDescriptions(input_file, True, transformErrorName) File "/home/ubuntu/samba/source4/scripting/bin/gen_error_common.py", line 52, in parseErrorDescriptions for line in file_contents: File "/usr/lib/python3.5/encodings/ascii.py", line 26, in decode return codecs.ascii_decode(input, self.errors)[0] UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 318: ordinal not in range(128) In this case, we have to use `io.open` with `encoding='utf8'`. However, then we got unicode strs and try to write them with other strs into new file, which means the new file must also open with utf-8 and all other strs have to be unicode, too. Instead of prefix `u` to all strs, a more easier/elegant way is to enable unicode literals for the python scripts, which we normally didn't do in samba. Since both `gen_werror.py` and `gen_ntstatus.py` are bin scripts and no other modules import them, it should be ok for this case. Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Feb 8 06:34:47 CET 2019 on sn-devel-144
* s4:dsdb:util: make use of samba_runcmd_export_stdin()Stefan Metzmacher2019-02-071-6/+14
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
* Clean up reference used with PyDict_SetxxxNoel Power2019-02-075-5/+8
| | | | | | | | | | | | PyDictSetxxx methods don't steal reference so if the items added to the dictionary were created just for the purpose of inserting into the dict then we need to decref them. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Thu Feb 7 17:17:46 CET 2019 on sn-devel-144
* Cleanup (decref) some objects added to list.Noel Power2019-02-071-2/+16
| | | | | | | | | PyList_Append doesn't steal references, so if the item created is a temp object, created just to be added to the list we need to decref the item appended in order for it to be released. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* decref results of PyStr_FromStringNoel Power2019-02-071-3/+12
| | | | | | | | | Where we create temporary objects (which are added to containers) these objects already get there ref count incremented. In this case we need to decref those objects to ensure they are released. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* Cleanup references to module objects returned from PyImport_ImportModuleNoel Power2019-02-075-19/+51
| | | | | Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* Decrement references to python objects passed to Py_BuildValueNoel Power2019-02-071-1/+5
| | | | | | | | | | | | | | Py_BuildValue when processing format 'O' will 'Pass a Python object untouched (except for its reference count, which is incremented by one' Basically this means if you are using a new reference to a PyObject to pass to BuildValue (to be used with the 'O' format) the reference *isn't* stolen so you really do need to DECREF it in order to ensure it gets cleaned up. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* build: replace SAMBA3_ADD_OPTION with samba_add_onoff_optionDavid Disseldorp via samba-technical2019-02-011-1/+1
| | | | | | | | | The former is just an alias for the latter. samba_add_onoff_option() better describes what the function actually does, so use that and remove the alias. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Noel Power <npower@samba.org>
* py_net: fix != None checkDouglas Bagnall2019-02-011-1/+1
| | | | | | | Py_None is not false in C, so this branch was always taken. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/param/provision: check samdb argument in provision_bare()Douglas Bagnall2019-02-011-2/+7
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/pyauth: fix memory leak when context_new() has bad argumentsDouglas Bagnall2019-02-011-0/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/pyauth: insist on proper ldb in context_new()Douglas Bagnall2019-02-011-0/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4/pyauth: check ldb argument in py_user_session()Douglas Bagnall2019-02-011-0/+4
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pygensec: insist on proper AuthContext in start_serverDouglas Bagnall2019-02-011-1/+9
| | | | | | | Fixes another segfault. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Tests for segfaults in python bindingsDouglas Bagnall2019-02-011-0/+3
| | | | | | | | These tests run in a child process and are regarded as succeeding if they don't die by signal. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* cracknames: Change search filter to use the smaller indexGarming Sam2019-02-011-2/+2
| | | | | | | | In large domains with many users, '(objectClass=User)' may as well not be specified because it's iterating over the entire database. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* selftest: Remove unnecessary tests.py options from proclimit testsTim Beale2019-02-011-3/+1
| | | | | | | | | | | | It seems like these extra options were just copy-n-pasted from another test. The process_limits test doesn't actually try to use these env variables at all. All the test is doing is creating LDAP connections to the DC. The SOCKET_WRAPPER_DEFAULT_IFACE may have perhaps been needed, but we can avoid this by dropping ':local' from the testenv and running the test as a "client" instead. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status